{"id":6147,"date":"2026-10-15T13:01:07","date_gmt":"2026-10-15T18:01:07","guid":{"rendered":"https:\/\/cert.pa\/?p=6147"},"modified":"2026-10-15T13:01:08","modified_gmt":"2026-10-15T18:01:08","slug":"csirt-panama-aviso-2026-oct-15-vulnerabilidad-critica-en-cisco-secure-email-gateway-que-permite-escribir-archivos-arbitrarios-y-ejecutar-comandos-como-root-cve-2026-76519","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=6147","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2026-oct-15: Vulnerabilidad Cr\u00edtica en Cisco Secure Email Gateway que permite escribir archivos arbitrarios y ejecutar comandos como root \u2014 CVE-2026-76519"},"content":{"rendered":"\n

Fecha de emisi\u00f3n:<\/strong> 15 de octubre de 2026
CVE ID:<\/strong> CVE-2026-76519
Severidad:<\/strong> CR\u00cdTICA \u2014 CVSS 3.1: 9.8
Vector CVSS:<\/strong> CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H
Tipo de vulnerabilidad:<\/strong> CWE-23: Recorrido de directorios relativo (relative path traversal)
Producto afectado:<\/strong> Cisco Secure Email Gateway (f\u00edsico y virtual) con Cisco AsyncOS
Explotaci\u00f3n activa:<\/strong> S\u00ed \u2014 Incluida en el cat\u00e1logo CISA KEV (Known Exploited Vulnerabilities) desde el 14 de octubre de 2026 (fecha l\u00edmite para agencias federales de EE. UU.: 17 de octubre de 2026)
Fuente:<\/strong> Cisco PSIRT \/ NVD \/ CISA \/ Help Net Security \/ INCIBE-CERT \u00b7 avisos \/ CERT-FR \u00b7 avisos
Clasificaci\u00f3n TLP:<\/strong> TLP:CLEAR (Difusi\u00f3n p\u00fablica)<\/p>\n\n\n\n

I. Descripci\u00f3n<\/strong><\/p>\n\n\n\n

Se ha identificado una vulnerabilidad de recorrido de directorios (path traversal) en la funci\u00f3n Advanced Malware Protection (AMP) de Cisco Secure Email Gateway, registrada como CVE-2026-76519 y calificada con 9.8 de 10 en la escala CVSS 3.1. Un atacante remoto, sin autenticaci\u00f3n, podr\u00eda escribir archivos arbitrarios en el sistema operativo subyacente y ejecutar comandos con privilegios de root.<\/p>\n\n\n\n

El fallo se debe a un manejo incorrecto de los archivos adjuntos cuando el servicio File Reputation est\u00e1 habilitado. Basta con que el atacante env\u00ede un correo con un adjunto especialmente dise\u00f1ado a trav\u00e9s del equipo afectado; no se requiere interacci\u00f3n del usuario.<\/p>\n\n\n\n

El 14 de octubre de 2026, la Agencia de Ciberseguridad y Seguridad de Infraestructura de Estados Unidos (CISA) la incorpor\u00f3 a su cat\u00e1logo de Known Exploited Vulnerabilities (KEV). Cisco PSIRT confirma que tuvo conocimiento de explotaci\u00f3n activa en octubre de 2026.<\/p>\n\n\n\n

Descripci\u00f3n t\u00e9cnica publicada en NVD (en ingl\u00e9s): \u00abA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.\u00bb<\/p>\n\n\n\n

II. Productos Afectados<\/strong><\/p>\n\n\n\n

El equipo es vulnerable solo si se cumplen ambas<\/strong> condiciones: (1) el servicio File Reputation (parte de AMP) est\u00e1 habilitado y asignado a una pol\u00edtica de correo, y (2) la versi\u00f3n de Content Scanner Tools es anterior a 25.3.0.5525.<\/p>\n\n\n\n

Producto<\/th>Versiones afectadas<\/th>Versi\u00f3n corregida<\/th><\/tr><\/thead>
Cisco AsyncOS para Secure Email Gateway 15.5 (y anteriores)<\/td>Anteriores a 15.5.5-014<\/td>15.5.5-014 (Cisco recomienda migrar a 16.5.0-780)<\/td><\/tr>
Cisco AsyncOS para Secure Email Gateway 16.0<\/td>Todas<\/td>Migrar a una versi\u00f3n corregida (16.5.0-780)<\/td><\/tr>
Cisco AsyncOS para Secure Email Gateway 16.5<\/td>Anteriores a 16.5.0-780<\/td>16.5.0-780<\/td><\/tr>
Content Scanner Tools (todas las versiones de AsyncOS con licencia y soporte)<\/td>Anteriores a 25.3.0.5525<\/td>25.3.0.5525 o posterior<\/td><\/tr>
Cisco Secure Email Cloud Gateway<\/td>\u2014<\/td>No requiere acci\u00f3n; corregido por Cisco<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

No afectados: Cisco Secure Email and Web Manager y Cisco Secure Web Appliance.<\/p>\n\n\n\n

III. Acciones Requeridas<\/strong><\/p>\n\n\n\n

1. Verificar exposici\u00f3n<\/strong>
En la interfaz web, revisar Mail Policies > Incoming\/Outgoing Mail Policies > Advanced Malware Protection<\/em> y comprobar si est\u00e1 marcada la casilla Enable File Reputation<\/em>. En la CLI, ejecutar contentscannerstatus<\/code> para ver la versi\u00f3n de Content Scanner Tools.<\/p>\n\n\n\n

2. Actualizar inmediatamente<\/strong>
Actualizar Content Scanner Tools a la versi\u00f3n 25.3.0.5525 o posterior con el comando contentscannerupdate<\/code> (no requiere actualizar AsyncOS ni reiniciar el equipo), o habilitar las actualizaciones autom\u00e1ticas en Security Services > Service Updates<\/em>. Adem\u00e1s, actualizar AsyncOS a 15.5.5-014 o 16.5.0-780 seg\u00fan corresponda.<\/p>\n\n\n\n

3. No existen soluciones alternativas<\/strong>
Cisco indica que no hay mitigaciones temporales para esta vulnerabilidad. Como medida general de endurecimiento, separar las interfaces de correo y de administraci\u00f3n, impedir el acceso a la administraci\u00f3n desde Internet y enviar los registros a un servidor externo.<\/p>\n\n\n\n

4. Verificar posible compromiso<\/strong>
El parche cierra el vector de explotaci\u00f3n, pero no elimina un acceso que el atacante ya haya obtenido. Revisar los registros del sistema con:<\/p>\n\n\n\n

grep \"System Security\" system_logs<\/code><\/p>\n\n\n\n

    \n
  • \u00abSystem Security: Suspected compromise indicator was found\u2026\u00bb<\/em>: compromiso detectado; seguir las recomendaciones de recuperaci\u00f3n del fabricante.<\/li>\n\n
  • \u00abSystem Security: Security scan did not complete\u2026\u00bb<\/em>: contactar al TAC de Cisco.<\/li>\n\n
  • \u00abSystem Security: No compromise indicator was found.\u00bb<\/em>: sin indicios; actualizar si aplica.<\/li>\n<\/ul>\n\n\n\n

    En cl\u00fasteres, revisar cada equipo miembro. Dado que el atacante puede obtener privilegios de root y borrar evidencias, contrastar tambi\u00e9n los registros de firewall y de red en busca de cargas inesperadas desde el equipo hacia IP externas o descargas desde IP maliciosas.<\/p>\n\n\n\n

    Si se confirma el compromiso en un equipo virtual: preservar la evidencia forense antes<\/strong> de actualizar (la actualizaci\u00f3n destruye registros), desplegar una m\u00e1quina nueva con versi\u00f3n corregida, reconstruir la configuraci\u00f3n sin importar archivos previos y renovar credenciales y material criptogr\u00e1fico. En cl\u00fasteres, restaurar todos los miembros, ya que las llaves SSH compartidas podr\u00edan permitir comprometer al resto. En equipos f\u00edsicos, contactar al TAC de Cisco. Reportar cualquier hallazgo a incidentes@cert.pa.<\/p>\n\n\n\n

    IV. Referencias<\/strong><\/p>\n\n\n\n

      \n
    • Cisco PSIRT. Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp). https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-esa-afw-zqYJkjxp<\/li>\n\n
    • National Institute of Standards and Technology (NIST). National Vulnerability Database: CVE-2026-76519. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-76519<\/li>\n\n
    • CISA. Known Exploited Vulnerabilities Catalog. https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog<\/li>\n\n
    • Help Net Security. CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products. https:\/\/www.helpnetsecurity.com\/2026\/10\/15\/cve-2026-0322-cve-2026-76519-cve-2026-105133-cve-2026-105134-exploted\/<\/li>\n\n
    • INCIBE-CERT \u00b7 avisos. M\u00faltiples vulnerabilidades en productos de Cisco. https:\/\/www.incibe.es\/incibe-cert\/alerta-temprana\/avisos\/multiples-vulnerabilidades-en-productos-de-cisco-17<\/li>\n\n
    • CERT-FR \u00b7 avisos. Vuln\u00e9rabilit\u00e9 dans Cisco AsyncOS Software pour Secure Email Gateway (15 octobre 2026). https:\/\/www.cert.ssi.gouv.fr\/avis\/CERTFR-2026-AVI-1325\/<\/li>\n<\/ul>\n\n\n\n

      V. Informaci\u00f3n de Contacto<\/strong><\/p>\n\n\n\n

      CSIRT PANAMA \u00b7 Computer Security Incident Response Team
      Autoridad Nacional para la Innovaci\u00f3n Gubernamental
      E-Mail: incidentes@cert.pa \u00b7 info@cert.pa
      Phone: +507 520-CERT (2378) \u00b7 Web: https:\/\/cert.pa \u00b7 X: @CSIRTPanama \u00b7 Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"

      Fecha de emisi\u00f3n: 15 de octubre de 2026CVE ID: CVE-2026-76519Severidad: CR\u00cdTICA \u2014 CVSS 3.1: 9.8Vector CVSS: CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:HTipo de vulnerabilidad: CWE-23: […]<\/p>\n","protected":false},"author":5,"featured_media":6091,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4],"tags":[76,72,38,19,68],"class_list":["post-6147","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-actualizaciones","tag-avisos-de-seguridad","tag-cisco","tag-correo-electronico","tag-vulnerabilidades","severidad-critico"],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/6147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6147"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/6147\/revisions"}],"predecessor-version":[{"id":6149,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/6147\/revisions\/6149"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/6091"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}